cube-js/cube

Automatically retrieve Redshift cluster credentials

Open

#306 opened on Dec 21, 2019

View on GitHub
 (3 comments) (0 reactions) (0 assignees)Rust (19,563 stars) (1,965 forks)batch import
driver:redshifthelp wanted

Description

Is your feature request related to a problem? Please describe. The AWS Redshift SDK allows retrieving credentials via an API:

import Redshift, { ClusterCredentials } from 'aws-sdk/clients/redshift';

const getCredentials = async () => {
  const creds = await redshift.getClusterCredentials({
    ClusterIdentifier: process.env.CUBEJS_DB_HOST,
    DbUser: process.env.CUBEJS_DB_USER,
  }).promise();

  if (!creds.DbUser && !creds.DbPassword) {
    throw new Error('Unable to retrieve Redshift credentials');
  }

  return creds as Required<ClusterCredentials>;
};

getCredentials()
  .then((credentials) => {
    const config = {
      database : process.env.CUBEJS_DB_NAME,
      host: process.env.CUBEJS_DB_HOST,
      password : creds.DbPassword,
      port: process.env.CUBEJS_DB_PORT,
      user: creds.DbUser,
    };
  })

Describe the solution you'd like

It would be great if CubeJS would automatically attempt to do the above if the CUBEJS_DB_PASS environment variable is omitted for Redshift projects.

Additional context A Serverless project using Redshift would require additional permissions to the IAM role:

iamRoleStatements:
    - Effect: 'Allow'
      Action:
        - 'redshift:GetClusterCredentials'
      Resource:
        - '<REDSHIFT_CLUSTER_ARN>/<REDSHIFT_USER>'

Contributor guide